Search code examples
herokucookiessetcookiesamesite

How do I set cookies within Heroku Review App?

I am managing two separate apps through two different Heroku pipelines.

App 1 - Handles my auth, this is a login landing page. App 2 - The main app, can access after authenticating via App 1.

I have separate review apps running for each app. The reasoning was so I can have both Review Apps under the .herokuapp.com domain.

App 1 takes Username, Password, and sets a JWT. In App 1, a query param is set and it contains a callbackUrl to App2. The JWT is set as a cookie in App 1 and sent to App 2 via a cookie (a token).

This is a problem with the new Same-Site Rules in Chrome. However, I have read various articles and workarounds for this, and my Cookies are still blocked. Here is the error:

the Set-Cookie was blocked because its domain attribute was invalid with regards to the current host url. enter image description here

I believe they are blocked because the domain .herokuapp.com is on the Public Suffix List, so no matter what I do, they will always be blocked.

Is there a workaround for this? Can I use my own domain with a review app? Ideally:

app1.helloworld.com app2.helloworld.com

.helloworld.com would be the domain.

Solution

  • Indeed they are blocked due to the domain being on suffix.

    But you can block chrome from registering that you are on the suffix list through creating a library with automated deployments similar to hstspreload and then also providing a mechanism that any HTTP library can update the packaged list via their own fetching mechanism. sadly you cannot reliably exclude .herokuapp.com from the suffix list or any other website for that matter.

    for those wanting to see more about attempting to remove from suffix, here are the pros and cons and other theorized attempts: https://forum.blocsapp.com/t/remove-html-suffix/1643